PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agents

Guangsheng Yu; Qin Wang; Rui Lang; Shuai Su; Xu Wang

cs.CRMar 19, 2026

PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agents

Authors: Guangsheng Yu, Qin Wang, Rui Lang, Shuai Su, Xu Wang

Organizations: University of Technology Sydney · CSIRO Data61, Australia

Abstract

Cloud-hosted large language models (LLMs) have become the de facto planners in agentic systems, coordinating tools and guiding execution over local environments. In many deployments, however, the environment being planned over is private, containing source code, files, credentials, and metadata that cannot be exposed to the cloud. Existing solutions address adjacent concerns, such as execution isolation, access control, or confidential inference, but they do not control what cloud planners observe during planning: within the permitted scope, raw environment state is still exposed. We introduce PlanTwin, a privacy-preserving architecture for cloud-assisted planning without exposing raw local context. The key idea is to project the real environment into a planning-oriented digital twin: a schema-constrained and de-identified abstract graph that preserves planning-relevant structure while removing reconstructable details. The cloud planner operates solely on this sanitized twin through a bounded capability interface, while a local gatekeeper enforces safety policies and cumulative disclosure budgets. We further formalize the privacy-utility trade-off as a capability granularity problem, define architectural privacy goals using $(k,δ)$ -anonymity and $ε$ -unlinkability, and mitigate compositional leakage through multi-turn disclosure control. We implement PlanTwin as middleware between local agents and cloud planners and evaluate it on 60 agentic tasks across ten domains with four cloud planners. PlanTwin achieves full sensitive-item non-disclosure (SND = 1.0) while maintaining planning quality close to full-context systems: three of four planners achieve PQS $> 0.79$ , and the full pipeline incurs less than 2.2% utility loss.

Figures & tables

Approach	①	②	③	④	⑤
Claude Code Sandboxing ( Anthropic, 2025b )	✓	✗	✗	✗	✓
OpenAI Codex Sandbox ( OpenAI, 2025 )	✓	✗	✗	✗	✓
MCP Specification ( Anthropic, 2024 )	✓	$\boldsymbol{\circ}$	✓	✗	✓
E2B / Firecracker VMs ( E2B, 2025 )	✓	✗	✗	✗	✓
Progent ( Shi et al., 2025 )	✓	✗	✗	✗	✓
MiniScope ( Zhu et al., 2025 )	✓	✗	✗	✗	✓

Table 1. Privacy/security approaches for LLM agent systems.

Figure 1. End-to-end architecture of PlanTwin . The trusted local edge layer (left) transforms raw context $X_{t}$ through a four-stage privacy projection pipeline into a sanitized digital twin $Z_{t}$ , which crosses the trust boundary to the cloud planner (center-right). The planner reasons over the typed abstract graph and capability catalog to produce a declarative plan $P_{t}$ . The trusted local execution plane (right) validates each step through a gatekeeper, executes on raw data, and sanitizes outputs via $\Pi_{\text{out}}$ before returning results $Y_{t}$ . The cloud never observes raw files, paths, credentials, or code.

Figure 2. The 4-stage privacy projection pipeline. Raw local context enters Stage 1 (typed extraction via local small language model (SLM) and heuristics), proceeds through Stage 2 (sensitive entity redaction via deterministic regex patterns with code-specific rules), Stage 3 (value generalization into bounded buckets), and Stage 4 (schema projection into fixed JSON). The output is a planning-sufficient digital twin $Z_{t}$ that contains no raw text, filenames, paths, or credentials. A companion output sanitizer $\Pi_{\text{out}}$ applies Stages 2–4 to execution results before cloud exposure.

Granularity	Example	Utility $\uparrow$	Privacy Cost $\downarrow$
Too coarse	process_project	Low	Low
Orchestration	security_audit(art_1)	High	Medium
Too fine	read_line(art_1, 42)	High	High

Table 2. Capability granularity trade-off.

Field	$w_{f}$	Rationale
kind	0.5	Low entropy, many objects share types
semantic_class	2.0	Higher specificity
contains (per tag)	1.0	Content indicators
usable_for (per tag)	0.5	Functional, less identifying
Typed edge (per edge)	3.0	Relational structure is highly identifying
freshness	0.5	Temporal bucket, coarse

Table 3. Schema field disclosure costs.

Evaluation dimensions	Ref.	Results
Planning utility	§ 5.2	Table 5 , Fig. 3
Sensitive-item non-disclosure	§ 5.2	Table 5
System overhead	§ 5.4	Table 6
Per-domain generalization	§ 5.5	Table 5
Adversarial re-identification risk	§ 5.6	Fig. 4 , Fig. 6
Pipeline stage ablation	§ 5.7	Fig. 5

Table 4. Evaluation roadmap.

Planner	Method	Per-Domain PQS										Combined ( $n$ =60)
Planner	Method	Code	Doc	Debug	DevOps	Pipe.	SecIR	MLOps	Front.	DB	API-I	PQS $\uparrow$	Prec $\uparrow$	SND $\uparrow$	NL $\downarrow$
Cloud LLM Planners
Kimi K2.5	Raw Context	0.77	0.77	0.67	0.81	0.85	0.80	0.93	0.84	0.93	0.98	0.843	0.831	0.000	1.000
Kimi K2.5	PII Redaction	0.85	0.80	0.75	0.88	0.93	0.93	0.89	0.88	0.88	1.00	0.887	0.886	0.835	0.165
Kimi K2.5	PlanTwin	0.79	0.80	0.68	0.72	1.00	0.74	0.79	0.67	0.90	0.91	0.808	0.776	1.000	0.617
Gemini 3 Flash	Raw Context	0.81	0.40	0.67	0.90	0.95	0.88	0.87	0.78	0.91	1.00	0.832	0.833	0.000	1.000

Table 5. Main results across ten task domains (60-task evaluation per method)

Figure 3. Privacy-utility trade-off for 19 configurations over 60 tasks in 10 domains. Only PlanTwin reaches the ideal high-privacy/utility region, achieving SND=1.0 with PQS

>

0.7. Error bars show per-task standard deviation.

Planner

Method

Phase (mean)

Per-Domain Total Latency

Med.

Proj.

API

Code

Doc

Debug

DevOps

Pipe.

SecIR

MLOps

Front.

API-I

Cloud LLM Planners

Kimi K2.5

Raw Context

—

53.0 s

67.9 s

101.5 s

52.7 s

88.0 s

105.4 s

111.2 s

95.4 s

48.4 s

248.2 s

137.9 s

66.8 s

Kimi K2.5

PII Redaction

<

0.1 s

79.1 s

92.3 s

60.1 s

34.9 s

73.7 s

92.4 s

102.4 s

42.6 s

306.7 s

109.6 s

332.5 s

75.2 s

Kimi K2.5

PlanTwin

13.3 s

81.2 s

204.2 s

135.2 s

264.8 s

65.5 s

66.7 s

112.4 s

303.8 s

377.0 s

115.9 s

103.2 s

119.6 s

Gemini 3 Flash

Raw Context

—

6.5 s

17.8 s

11.5 s

12.9 s

13.6 s

12.2 s

19.9 s

19.3 s

15.5 s

17.1 s

13.4 s

14.4 s

Table 6. Per-task overhead breakdown (seconds)

Figure 4. Adversarial re-identification accuracy by strategy with

k=15

candidate files. Error bars show standard deviation, and the dashed line marks the random baseline

1/k

. Full fingerprint matching reaches 94.1% accuracy.

Figure 5. Pipeline stage ablation across four variants. All maintain SND = 1.0, while PQS stays within 0.773–0.790, indicating minimal utility loss from privacy hardening. Error bars show per-task standard deviation.

Figure 6. Re-identification accuracy versus anonymity set size

k

. Full fingerprint matching remains above 88% even at

k=30

, while weaker strategies degrade with larger pools. Shaded regions denote

\pm 1

std. dev.

Figure 7. Budget threshold sensitivity versus scale factor

\alpha

. PQS saturates at

\alpha\geq 0.75

, while normalized leakage peaks at

\alpha=0.75

and then declines as larger budgets leave more headroom. Shading denotes

\pm 1

std. dev. in PQS.

Figure 8. Per-domain PQS under single- and multi-turn budgeting. Multi-turn most degrades data-pipeline and coding tasks. Repeated access to the same objects exhausts budgets.

Figure 9. Per-domain normalized leakage in single-/multi-turn modes. Multi-turn drives NL to 1.0 across domains.

Symbol	Meaning
$X_{t}$	Full local context at time $t$
$Z_{t}$	Sanitized digital twin (= $G_{t}$ )
$\Pi(\cdot)$	Privacy projection operator (4-stage pipeline)
$\Pi_{\text{out}}$	Output sanitizer (Stages 2–4 on execution results)
$G_{t}=(\mathcal{V}_{t},\mathcal{E}_{t},\mathcal{A}_{t})$	Typed abstract graph (nodes, edges, attributes)
$\mathcal{C}=\{c_{1},\ldots,c_{n}\}$	Local capability catalog

Table 7. Notation.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Thm.	Property	Key assumption	Empirical evidence
1	$(k,\delta)$ -anonymity	$\eta$ -bounded side info	§ 5.6 : 94.1% w/o budget
2	$\epsilon$ -unlinkability	Uniform on support	$\epsilon\leq\tau(o)$ via budget
3	Composition bound	Cost calibration $w_{f}\geq\ln b_{f}$	§ 5.9 : NL ${=}$ 1.0

Appendix

Table 8. Mapping between formal security properties, assumptions, and empirical evidence.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 504 papers

PAAC: Privacy-Aware Agentic Device-Cloud Collaboration
May 9, 2026Liangqi Yuan, Wenzhi Fang, Shiqiang Wang +1Privacy-Preserving Language Models AI Agent Security
Purdue University · University of Exeter
Ask Without Telling: Local SLMs Consult Cloud LLMs Without Revealing Task Intent
Sep 26, 2026Yanmeng Wang, Yunxuan Li, Shilong Fan +2Privacy-Preserving Language Models Privacy Protection for LLM Agents
Nanjing University of Posts and Telecommunications, Nanjing, 210023, China · The Chinese University of Hong Kong, Shenzhen, 518172, China
Twin Agent: Context Residual Compression for Privilege Separated Agents
Jul 21, 2026Zhanhao Hu, Dennis Jacob, Xiao Huang +3AI Agent Security LLM Agent Security
University of California, Berkeley · University of Chicago · University of Illinois, Urbana-Champaign

May 9, 2026J/K move · Enter open · S save

PAAC: Privacy-Aware Agentic Device-Cloud Collaboration

Liangqi Yuan, Wenzhi Fang, Shiqiang Wang, Christopher G. Brinton

Purdue University · University of Exeter

Privacy-Preserving Language Models AI Agent Security Privacy Protection for LLM Agents LLM Agents

Open paper AskPDF arXiv

Large language model (LLM) agents face a structural tension: cloud agents provide strong reasoning but expose user data, while on-device agents preserve privacy at the cost of overall capability. Existing device-cloud designs treat this boundary as a compute split rather than a trust boundary suited to agentic workloads, and existing sanitizers force a choice between policy flexibility and the structural fidelity tool calls require. In this work, we develop PAAC, a privacy-aware agentic framework that aligns planner--executor decomposition with the device-cloud boundary so that role specialization itself becomes the privacy mechanism. The cloud agent reasons over typed placeholder tokens that preserve each sensitive value's reasoning role while discarding its content, while the on-device agent identifies sensitive spans and distills each step's execution outcome into compact key findings. Sanitization confines the on-device LLM to proposing which spans to mask, while a deterministic registry performs all substitution and reversal, keeping actions directly executable on device. On three agentic benchmarks under strict privacy settings, PAAC dominates the Pareto frontier of privacy and accuracy, improving average accuracy by 15-36% and reducing average leakage by 2-6

\times

over state-of-the-art device-cloud baselines, with the largest margins on privacy targets outside fixed entity taxonomies. We find consistent improvements on 17 additional benchmarks spanning 10 domains, including math, science, and finance.

Abstract

AI Agent Security

Explore similar work

PAAC: Privacy-Aware Agentic Device-Cloud Collaboration

Ask Without Telling: Local SLMs Consult Cloud LLMs Without Revealing Task Intent

Twin Agent: Context Residual Compression for Privilege Separated Agents